topic Re: Ping to allow on Security Policy in General Topics

Ping to allow on Security Policy

samirs — Tue, 10 Jan 2017 04:37:01 GMT

I have made security policy on Paloalto as per port base requirment.

eg.

I have allowed http, https, dns as a service. But i also want ping to be allowed in the same policy.

Please advice how can achive this.

Samir.

Re: Ping to allow on Security Policy

santonic_007 — Tue, 10 Jan 2017 07:16:13 GMT

You can't in same rule. Make duplicate rule with ping (and icmp if needed) as application.

If you put ping in same rule it would be triggering only on ping on ports TCP 80, 443 and UDP 53 which will of course never happen as ICMP is seperate (port-less) protocol.

Re: Ping to allow on Security Policy

BPry — Tue, 10 Jan 2017 15:21:37 GMT

As already stated this wouldn't be something that you do in the same rule. One thing that I might actually question is why you included DNS in the same rule that you allowed HTTP/HTTPS? DNS is likely something that you won't care to have logged, while you probably want to log HTTP/HTTPS traffic, so if you seperate the rule out so that you have one rule for 'web-browsing' one rule for 'DNS' and one rule for 'Ping' it gets alot easier to work with any special requests that come through and all the rules get to be clearly labled with what they do. You also get the added benefit of not having to log DNS/Ping but you cand still have logging enabled for HTTP/HTTPS traffic.